PR #24682 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24682 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24682.patch
Fixes: heap-buffer-overflow (read) Fixes: xU5xVR9zXRej Fixes: ANT-2026-K32Z5S4E-tdsc-cursor.avi Found-by: Claude and Ada Logics >From c5178fd44f395d6cc0680d3534fea1c6e9aab476 Mon Sep 17 00:00:00 2001 From: David Korczynski <[email protected]> Date: Thu, 24 Sep 2026 21:52:40 +0200 Subject: [PATCH] avcodec/tdsc: validate the cursor dimensions before storing them Fixes: heap-buffer-overflow (read) Fixes: xU5xVR9zXRej Fixes: ANT-2026-K32Z5S4E-tdsc-cursor.avi Found-by: Claude and Ada Logics --- libavcodec/tdsc.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/libavcodec/tdsc.c b/libavcodec/tdsc.c index 102b4ae966..f31655ce3d 100644 --- a/libavcodec/tdsc.c +++ b/libavcodec/tdsc.c @@ -199,24 +199,23 @@ static void tdsc_paint_cursor(AVCodecContext *avctx, uint8_t *dst, int stride) static int tdsc_load_cursor(AVCodecContext *avctx) { TDSCContext *ctx = avctx->priv_data; - int i, j, k, ret, cursor_fmt; + int i, j, k, ret, cursor_fmt, w, h; uint8_t *dst; ctx->cursor_hot_x = bytestream2_get_le16(&ctx->gbc); ctx->cursor_hot_y = bytestream2_get_le16(&ctx->gbc); - ctx->cursor_w = bytestream2_get_le16(&ctx->gbc); - ctx->cursor_h = bytestream2_get_le16(&ctx->gbc); + w = bytestream2_get_le16(&ctx->gbc); + h = bytestream2_get_le16(&ctx->gbc); - ctx->cursor_stride = FFALIGN(ctx->cursor_w, 32) * 4; cursor_fmt = bytestream2_get_le32(&ctx->gbc); - if (ctx->cursor_w < 1 || ctx->cursor_w > 256 || - ctx->cursor_h < 1 || ctx->cursor_h > 256) { - av_log(avctx, AV_LOG_ERROR, - "Invalid cursor dimensions %dx%d.\n", - ctx->cursor_w, ctx->cursor_h); + if (w < 1 || w > 256 || h < 1 || h > 256) { + av_log(avctx, AV_LOG_ERROR, "Invalid cursor dimensions %dx%d.\n", w, h); return AVERROR_INVALIDDATA; } + ctx->cursor_w = w; + ctx->cursor_h = h; + ctx->cursor_stride = FFALIGN(w, 32) * 4; if (ctx->cursor_hot_x > ctx->cursor_w || ctx->cursor_hot_y > ctx->cursor_h) { av_log(avctx, AV_LOG_WARNING, "Invalid hotspot position %d.%d.\n", -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
